MEDIUM 6.9 NVD
CVE-2026-125369
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other po
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls.
References
- https://github.com/fsinfuhh/Bitpoll
- https://github.com/fsinfuhh/Bitpoll/blob/0.11.0/bitpoll/poll/views.py#L994
- https://github.com/fsinfuhh/Bitpoll/commit/71013d36a4d587e672eba225d94f7b94cd412ef9
- https://github.com/fsinfuhh/Bitpoll/issues/206
- https://www.vulncheck.com/advisories/bitpoll-through-0.11.0-unauthenticated-vote-and-comme
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-11-10 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.